FCP_FAZ_AN-7.6 practice questions 31–40

1. Question 31 · 50 in bank

   Select 2

   You must find a specific security event log in the FortiAnalyzer logs displayed in FortiView, but so far, you have been unsuccessful. Which two tasks should you perform to investigate why you are having this issue? (Choose two.)

   • AReview the ADOM data policy.
   • BCheck logs in Log Browse.
   • CDisable FortiView using the CLI and then enable it again.
   • DRebuild the SQL database and check FortiView.

   Show answer

   Answer: AB

   Next question

2. Question 32 · 50 in bank

   Refer to the exhibit.

   

   What can you conclude about the output?

   • AThe output is ADOM specific.
   • BBoth messages and logs are almost finished indexing
   • CThe message rate being higher than the log rate is not normal.
   • DThere are more traffic logs than event logs.

   Show answer

   Answer: C

   Next question

3. Question 33 · 50 in bank

   You are tasked with finding logs corresponding to a suspected attack on your network. You must use an interface where all identified threats within your timeframe are listed and organized. You also must be able to quickly export the information to a PDF file. Where can you go to accomplish this task?

   • AIncident
   • BLog View
   • CFortiAnalyzer Dashboards
   • DFortiView

   Show answer

   Answer: D

   Next question

4. Question 34 · 50 in bank

   Select 2

   Which two statements regarding the outbreak detection service are true? (Choose two.)

   • AIt automatically downloads new log parsers and reports
   • BIt automatically downloads new event handlers and reports
   • CNew downloads need to be accepted by system administrators
   • DAn additional license is required

   Show answer

   Answer: BD

   Next question

5. Question 35 · 50 in bank

   An analyst is using FortiAI on FortiAnalyzer to simplify certain tasks but is worried about exceeding the monthly token limit. Which query will take the fewest FortiAI tokens?

   • AShow logs for 192.168.1.10 (past weeks)
   • BShow logs for 192.168.1.10
   • CCan you show me all the log entries for the endpoint 192.168.1.10?
   • DShow all logs from the past week

   Show answer

   Answer: A

   Next question

6. Question 36 · 50 in bank

   As part of your analysis, you discover that a Medium severity level incident is fully remediated. You change the incident status to Closed: Remediated. How will FortiAnalyzer handle this incident?

   • AThe corresponding event will be marked as Mitigated
   • BThe incident will be deleted from the incident queue
   • CThe incidents dashboards will be updated
   • DThe incident severity will be nullified

   Show answer

   Answer: C

   Next question

7. Question 37 · 50 in bank

   Refer to the exhibits.

   

   

   

   Assume these are all the events that exist on FortiAnalyzer. How many events will be added to the incident created after running this playbook?

   • ASeven events will be added
   • BNo events will be added
   • CFour events will be added
   • DSix events will be added

   Show answer

   Answer: C

   Next question

8. Question 38 · 50 in bank

   Refer to the exhibits.

   

   

   The event shown in the exhibit has been escalated to an incident. Which SOC role is responsible for handling the escalated incident?

   • AIncident responder
   • BThreat hunter
   • CSOC engineer
   • DSecurity analyst

   Show answer

   Answer: A

   Next question

9. Question 39 · 50 in bank

   Which statement about sending notifications with incident updates is true?

   • ANotifications can be sent only when an incident is created or deleted.
   • BYou must configure an output profile to send notifications by email.
   • CAll connectors used for sending notifications must share the same notification settings.
   • DEach incident can send notifications to multiple external platforms.

   Show answer

   Answer: D

   Next question

10. Question 40 · 50 in bank

    Refer to the exhibit.

    

    An analyst is using FortiView to examine the top threats observed over the last 2 hours. What can the analyst conclude from the exhibit?

    • AA cross-site scripting (XSS) attack occurred on a DNS server
    • BA SQL injection attack occurred on an application.
    • CFortiAnalyzer has logged only three types of IPS attacks.
    • DMalware attacks should be prioritized over IPs attacks.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FAZ_AN-7.6 practice, question 31. 50 questions available.